{
    "$schema": "http://json-schema.org/draft-04/schema#",
    "title": "saml20_idp",
    "order": 2,
    "definitions": {
        "SingleSignOnService_Binding": {
            "type": "string",
            "enum": [
                "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
                "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
                "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign",
                "urn:oasis:names:tc:SAML:2.0:bindings:SOAP",
                "urn:oasis:names:tc:SAML:2.0:bindings:PAOS",
                "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact",
                "urn:oasis:names:tc:SAML:2.0:bindings:URI"
            ],
            "default": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
            "info": "Select the binding the IdP claims support for. A binding specifies the technical method of a connection."
        },
        "SingleLogoutService_Binding": {
            "type": "string",
            "enum": [
                "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
                "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST",
                "urn:oasis:names:tc:SAML:2.0:bindings:SOAP",
                "urn:oasis:names:tc:SAML:2.0:bindings:PAOS",
                "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Artifact",
                "urn:oasis:names:tc:SAML:2.0:bindings:URI"
            ],
            "default": "urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect",
            "info": "SingleLogoutService is not supported by the Engine Block. Select the SingleLogoutService binding an IdP claims support for. A binding specifies the protocol to access the service."
        },
        "NameIDFormat": {
            "type": "string",
            "enum": [
                "urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified",
                "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
                "urn:oasis:names:tc:SAML:2.0:nameid-format:persistent"
            ],
            "default": "urn:oasis:names:tc:SAML:2.0:nameid-format:transient",
            "info": "This indicates whether the nameID is set to something random or the same every time the user logs in. Transient can be used if the user does not need to be identified in a new session."
        }
    },
    "type": "object",
    "properties": {
        "id": {
            "type": "number"
        },
        "eid": {
            "type": "number"
        },
        "entityid": {
            "type": "string"
        },
        "type": {
            "type": "string",
            "enum": [
                "saml20-idp"
            ]
        },
        "revisionid": {
            "type": "number"
        },
        "state": {
            "type": "string",
            "enum": [
                "prodaccepted",
                "testaccepted"
            ]
        },
        "metadataurl": {
            "type": [
                "string",
                "null"
            ]
        },
        "allowedall": {
            "type": "boolean"
        },
        "manipulation": {
            "type": [
                "string",
                "null"
            ]
        },
        "manipulationNotes": {
            "type": [
                "string",
                "null"
            ]
        },
        "user": {
            "type": "string"
        },
        "created": {
            "type": "string"
        },
        "ip": {
            "type": "string"
        },
        "revisionnote": {
            "type": "string"
        },
        "active": {
            "type": "boolean"
        },
        "allowedEntities": {
            "type": "array",
            "items": {
                "type": "object",
                "properties": {
                    "name": {
                        "type": "string"
                    }
                }
            }
        },
        "stepupEntities": {
            "type": "array",
            "items": {
                "type": "object",
                "properties": {
                    "name": {
                        "type": "string"
                    },
                    "level": {
                        "type": [
                            "string"
                        ],
                        "enum": [
                            "http://test.surfconext.nl/assurance/loa2",
                            "http://test.surfconext.nl/assurance/loa3"
                        ],
                        "default": "http://test.surfconext.nl/assurance/loa2"
                    }
                }
            },
            "required": [
                "name",
                "level"
            ],
            "additionalProperties": false
        },
        "mfaEntities": {
            "type": "array",
            "items": {
                "type": "object",
                "properties": {
                    "name": {
                        "type": "string"
                    },
                    "level": {
                        "type": [
                            "string"
                        ],
                        "enum": [
                            "http://schemas.microsoft.com/claims/multipleauthn",
                            "test_with_local_value",
                            "transparant_authn_context"
                        ],
                        "default": "http://schemas.microsoft.com/claims/multipleauthn"
                    }
                }
            },
            "required": [
                "name",
                "level"
            ],
            "additionalProperties": false
        },
        "disableConsent": {
            "type": "array",
            "items": {
                "type": "object",
                "properties": {
                    "name": {
                        "type": "string"
                    },
                    "type": {
                        "type": [
                            "string",
                            "null"
                        ],
                        "enum": [
                            "no_consent",
                            "minimal_consent",
                            "default_consent",
                            null
                        ],
                        "default": "no_consent"
                    },
                    "explanation:en": {
                        "type": [
                            "string",
                            "null"
                        ]
                    },
                    "explanation:nl": {
                        "type": [
                            "string",
                            "null"
                        ]
                    }
                }
            },
            "required": [
                "name",
                "type"
            ],
            "additionalProperties": false
        },
        "notes": {
            "type": [
                "string",
                "null"
            ]
        },
        "metaDataFields": {
            "type": "object",
            "properties": {
                "certData": {
                    "type": "string",
                    "format": "certificate",
                    "info": "The supplied public certificate of the service. This must be a PEM encoded certificate. DER, CRT or CER are not supported."
                },
                "certData2": {
                    "type": "string",
                    "format": "certificate",
                    "info": "Up to three certificates per service can be defined. This is the second field for certificates you can enter. This must be a PEM encoded certificate. DER, CRT or CER are not supported."
                },
                "certData3": {
                    "type": "string",
                    "format": "certificate",
                    "info": "Up to three certificates per service can be defined. This is the third and last field for certificates you can enter. This must be a PEM encoded certificate. DER, CRT or CER are not supported."
                },
                "SingleLogoutService_Binding": {
                    "$ref": "#/definitions/SingleLogoutService_Binding",
                    "info": "SingleLogoutService is not supported by the Engine Block. Select the SingleLogoutService binding an IdP claims support for. A binding specifies the protocol to access the service."
                },
                "SingleLogoutService_Location": {
                    "type": "string",
                    "format": "url",
                    "info": "SingleLogoutService is not supported by the Engine Block. If the connected SP supports SAML 2.0 Single Logout, this will specify the endpoint element as a URL."
                },
                "mdrpi:RegistrationInfo": {
                    "type": "string",
                    "info": "The name of the authority that can register a service provider or identity provider."
                },
                "logo:0:url": {
                    "type": "string",
                    "format": "url",
                    "info": "Enter the URL to the logo used for this service. e.g. https://static.example-logo.nl/media/sp/logo.png."
                },
                "logo:0:width": {
                    "type": "number",
                    "info": "The width of the logo found at logo:0:url in pixels."
                },
                "logo:0:height": {
                    "type": "number",
                    "info": "The height of the logo found at logo:0:url in pixels."
                },
                "redirect.sign": {
                    "type": "boolean",
                    "info": "Whether authentication request, logout requests and logout responses should be signed. The default is FALSE. This is generally set for trusted proxies like OpenID Connect Gateway."
                },
                "coin:publish_in_edugain": {
                    "type": "boolean",
                    "info": "Set this for Identity Providers published in eduGAIN."
                },
                "coin:publish_in_edugain_date": {
                    "type": "string",
                    "format": "date-time",
                    "info": "When this entity first appeared in the eduGAIN feed. Usually the current time."
                },
                "coin:additional_logging": {
                    "type": "boolean",
                    "info": "Set to get an extended form of logging."
                },
                "coin:institution_id": {
                    "type": "string",
                    "info": "The defined client code. Generally an abbreviation of the name of the client."
                },
                "coin:institution_guid": {
                    "type": "string",
                    "format": "uuid",
                    "info": "This is a 128 bit number also known as a globally unique identifier (GUID or UUID) for this Identity Provider."
                },
                "coin:institution_type": {
                    "type": "string",
                    "info": "Client category this institution belongs to."
                },
                "coin:guest_qualifier": {
                    "type": "string",
                    "enum": [
                        "All",
                        "Some",
                        "None"
                    ],
                    "default": "All",
                    "info": "Services can use the guest attribute to offer guests a different set of functionality, the default behavior is to consider all users from an IdP as guest. Select: 1. All (default): All of the users from this IdP are marked as guests. 2 None: None of the users from this IdP marked as guests and all will be considered members. 3 Some: Most users will be a guest, and some of the users will be marked as members. When the IdP provides the attribute urn:oid:1.3.6.1.4.1.1076.20.100.10.10.1 (surfPersonAffiliation) with value member OpenConext considers it a member."
                },
                "coin:schachomeorganization": {
                    "type": "string",
                    "info": "The Identity Providers organization using the organization\u2019s domain name; syntax in accordance with RFC 1035. Usually the domain name of the organization. e.g. uniharderwijk.nl."
                },
                "NameIDFormat": {
                    "$ref": "#/definitions/NameIDFormat",
                    "info": "The format in which the service expects the response. This can be transient, transparent or unspecified."
                },
                "coin:disable_scoping": {
                    "type": "boolean",
                    "info": "Set to disable sending a scoping element in het authentication request to Active Directory Federation Services (ADFS) servers. Set for ADFS servers lower than 4.0."
                },
                "coin:hidden": {
                    "type": "boolean",
                    "info": "Set to make the IdP hidden in the dashboard when the IdP is not connected to a service."
                },
                "coin:ss:allow_scb_admin_rights": {
                    "type": "boolean",
                    "info": "Set to grant SAB SURFconext beheerders for this IdP the SURFconext verantwoordelijke rights."
                },
                "coin:signature_method": {
                    "type": "string",
                    "format": "url",
                    "enum": [
                        "http://www.w3.org/2000/09/xmldsig#rsa-sha1",
                        "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"
                    ],
                    "default": "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256",
                    "info": "Select the Secure Hash Algorithm (SHA) to use for signed authentication requests sent by Engineblock to this identity provider."
                },
                "coin:exclude_from_push": {
                    "type": "boolean",
                    "default": false,
                    "info": "Must be set for this Identity Provider to be excluded in the EB push."
                },
                "coin:allow_maintainers_to_manage_authz_rules": {
                    "type": "boolean",
                    "info": "Set this to allow maintainers of this Identity Provider to maintain authorization rules. Used in Dashboard."
                },
                "coin:display_admin_emails_in_dashboard": {
                    "type": "boolean",
                    "default": false,
                    "info": "Set this to allow regular users of this Identity Provider to see the SCB and SCV emails. Used in Dashboard."
                },
                "coin:display_stats_in_dashboard": {
                    "type": "boolean",
                    "default": false,
                    "info": "Set this to allow regular users of this Identity Provider to see the statistics. Used in Dashboard."
                }
            },
            "patternProperties": {
                "^name:(en|nl)$": {
                    "type": "string",
                    "info": "The name of the Identity Provider."
                },
                "^displayName:(en|nl)$": {
                    "type": "string",
                    "info": "The name of the Identity Provider as displayed in applications."
                },
                "^description:(en|nl)$": {
                    "type": "string",
                    "info": "The description of the Identity Provider."
                },
                "^contacts:([0-3]{1}):surName$": {
                    "type": "string",
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "The surname of the contact. e.g. for 'John Doe', 'Doe' is the surname."
                },
                "^contacts:([0-3]{1}):givenName$": {
                    "type": "string",
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "The given name of the contact. e.g. for 'John Doe', 'John' is the givenName."
                },
                "^contacts:([0-3]{1}):emailAddress$": {
                    "type": "string",
                    "format": "local-email",
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "The e-mail address; syntax in accordance with RFC 5322. e.g. m.l.vermeegen@university.example.org."
                },
                "^contacts:([0-3]{1}):telephoneNumber$": {
                    "type": "string",
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "The telephoneNumber of the contact."
                },
                "^contacts:([0-3]{1}):isSirtfiSecurityContact$": {
                    "type": "boolean",
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "Set if the contact for this Identity Provider is responsible for security."
                },
                "^contacts:([0-3]{1}):contactType$": {
                    "type": "string",
                    "enum": [
                        "technical",
                        "support",
                        "administrative",
                        "billing",
                        "other"
                    ],
                    "multiplicity": 4,
                    "sibblingIndependent": true,
                    "info": "From the pull down, select the type of contact."
                },
                "^OrganizationName:(en|nl)$": {
                    "type": "string"
                },
                "^OrganizationDisplayName:(en|nl)$": {
                    "type": "string",
                    "info": "The friendly name of the organization. e.g. University of Harderwijk."
                },
                "^OrganizationURL:(en|nl)$": {
                    "type": "string",
                    "format": "url",
                    "info": "The URL to the website of the service e.g. http://www.example-institution.nl/en/."
                },
                "^mdrpi:RegistrationPolicy:(en|nl)$": {
                    "type": "string",
                    "info": "The URL to the Registration Policy of the Identity Provider."
                },
                "^coin:entity_categories:([1-5]{1})$": {
                    "type": "string",
                    "enum": [
                        "http://refeds.org/category/research-and-scholarship",
                        "http://refeds.org/category/hide-from-discovery",
                        "http://www.geant.net/uri/dataprotection-code-of-conduct/v1",
                        "http://clarin.eu/category/clarin-member",
                        "http://refeds.org/category/academic-institution"
                    ],
                    "multiplicity": 5,
                    "startIndex": 1,
                    "info": "Select one of the entity categories applicable to this service. Entity Categories group federation entities that share common criteria."
                },
                "^SingleSignOnService:([0-9]{1}):Binding$": {
                    "$ref": "#/definitions/SingleSignOnService_Binding",
                    "multiplicity": 10,
                    "info": "Select the binding the IdP claims support for. A binding specifies the technical method of a connection."
                },
                "^SingleSignOnService:([0-9]{1}):Location$": {
                    "type": "string",
                    "format": "url",
                    "multiplicity": 10,
                    "info": "The URL to the a SAML protocol endpoint at an IdP that a client can contact to obtain a SAML authentication assertion for use at an SP. e.g. https://idp.example.org/idp/profile/SAML2/Redirect/SSO"
                },
                "^keywords:(en|nl)$": {
                    "type": "string",
                    "info": "This field defines searchable words in the WAYF dialogue for this Identity Provider."
                },
                "^shibmd:scope:([0-9]{1}):allowed$": {
                    "type": "string",
                    "multiplicity": 10,
                    "info": "Select the allowed permissible attribute scope for the role. The scope is an attribute-specific concept used in Shibboleth to enhance the functionality of the attribute acceptance policy features."
                },
                "^shibmd:scope:([0-9]{1}):regexp$": {
                    "type": "boolean",
                    "multiplicity": 10,
                    "info": "If not set or absent, the text content of the shibmd:Scope is interpreted as the literal scope value.  If not set the scope component of each scoped attribute value processed by the service provider MUST exactly match the value of <shibmd:Scope> element. If set, the text content of the shibmd:Scope is interpreted as specifying a regular expression.  If set, the scope component of each scoped attribute value processed by the service provider MUST match the regular expression."
                }
            },
            "required": [
                "name:en",
                "SingleSignOnService:0:Binding",
                "SingleSignOnService:0:Location"
            ],
            "additionalProperties": false
        }
    },
    "required": [
        "entityid",
        "state",
        "allowedall",
        "metaDataFields"
    ],
    "additionalProperties": false,
    "indexes": []
}